Passkeys are the biggest change to signing in for decades. They are built on an open standard from the FIDO Alliance and the W3C, called WebAuthn, and most major sites now offer them.
How a passkey works
When you create a passkey, your device makes a pair of keys. The private key stays with you. The public key goes to the website. To sign in, the site sends a fresh challenge, your device signs it with the private key after Face ID or Touch ID, and the site checks the signature with the public key.
Nothing secret ever crosses the network, and nothing secret is stored on the website. If the site is breached, the attacker gets public keys, which cannot sign anyone in.
Why phishing stops working
A passkey is tied to the exact website that created it. A fake page at a look-alike address simply has no passkey to use, so there is nothing for you to be tricked into typing.
Where passkeys live
A passkey has to be stored somewhere you can reach from your devices. Zen Passwords can save passkeys in your vault, encrypted like everything else, and offer them through AutoFill with the same Face ID glance you use for passwords.
Should you switch?
Use a passkey wherever a site offers one, especially for email and banking. Keep your password manager for everything else: most sites still need passwords, and many keep them as a fallback even after you add a passkey.
Questions
Are passkeys safer than passwords?
Yes, in two important ways. There is no shared secret on the website's servers to leak, and a passkey refuses to work on a look-alike phishing site.
Can I use passkeys and passwords together?
Yes. Most sites that offer passkeys keep your password as a fallback. A password manager can hold both side by side.